Cyber Essentials Certification

Boundary Firewalls and Internet Gateways

Secure configuration of firewalls and network gateways to prevent unauthorised access.

Implementation Requirements:

• Configure boundary firewalls to deny traffic by default
• Enable application-layer filtering where supported
• Document firewall rules and review regularly
• Secure remote access connections with multi-factor authentication

Secure Configuration

Establish secure baseline configurations for all devices and software systems.

Implementation Requirements:

• Apply security configuration guides for operating systems
• Remove or disable unnecessary applications and services
• Configure applications securely by default
• Regularly review and update security configurations

User Access Control

Control access to systems and applications with appropriate user privileges.

Implementation Requirements:

• Implement user account management procedures
• Enforce strong password policies or multi-factor authentication
• Apply principle of least privilege for user accounts
• Regular review of user access rights and permissions

Malware Protection

Deploy and maintain appropriate malware protection across all systems.

Implementation Requirements:

• Install approved anti-malware software on all devices
• Enable real-time scanning and automatic updates
• Configure email security and web filtering
• Regularly scan systems for malware and threats

Security Update Management

Timely installation of security updates for operating systems and applications.

Implementation Requirements:

• Enable automatic security updates where possible
• Implement patch management procedures for critical systems
• Test updates in non-production environment first
• Maintain inventory of all software requiring updates